Welcome to deming Discussions!

[dbarzin]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[thibaudpeter]

Amazing tool, very close to Enterprise functionality

Would it be possible to add or edit the Scoring ?
Like set it with 5 grading system like :
Ineffective
Poorly Effective
Moderately Effective
Effective, Highly
Effective

[dbarzin]

Good idea, I will put it in the roadmap !

[thibaudpeter]

OK, the admin can do everything (Good)
The users can't edit the "Configuration pannel" (Good)
But users can see all the Mesures, plan measures, and even assign controls to other users, which should be restricted

Users cannot login with their login, but their email addresses

[dbarzin]

This is absolutely logic but I do not know if this is really useful to segregate rights at this point.
Most of time there is a team of auditors that have access to all other auditors information.
2.
I agree that it has to be fixed.

[thibaudpeter]

[My personal point of view]
Most of the time, 2 line of defense assigns IT Controls to the 1st line of defense (IT Team/Lead)
2LoD reviews the evidences and scores the risk treatment rating (Effective/Ineffective..)
Audit can review everything or ask 2LoD to provide extracts

[dbarzin]

OK but only auditors should have read access to Deming.

[arnaud-lxbg]

Why should only auditors have access to Deming? That is a limitation.

A workflow could be:
1LoD (users) should be able to upload evidence of the measurement and propose it for closure.
2LoD (admins) review evidence and close (+ rate efficiency) and create measurements and schedule in the tool and assign them (might be self-service 1LoD in a very mature organisation, with only approval by 2LoD).
3LoD (auditors) review the dashboard, and some evidence sample.

[dbarzin]

Comment updated.

[dbarzin]

2. is fixed, you may login with "login" or "email"

[thibaudpeter]

Moien,
Unless I made an error, I had an issue with the composer self-command
Command "self-update"is not defined

Also I only noticed now that we are neighbor **Blv Royal :)

[dbarzin]

Moien Thibaud,
You might have an old version of composer.
Please update https://getcomposer.org/
Thanks,
Didier

[Sylvio1982]

Hi,
Thanks for the job.
Why are there no requirements details in the SMSI domain ?
I list 235 in total in the ISO 27001:2022

[dbarzin]

Could you be more precise ? What are these details ?
Are you talking about recommendations ?

[Sylvio1982]

Hello,
Thanks for your rapid return.
I am talking about the requirements present in the ISMS domain. Example with measure 5.x. Why not detail the requirements?

[dbarzin]

This could certainly be improved. I welcome contributions if you have suggestions for improvement.

[moiiom59]

Bonjour,
Est il possible d'installer Demin et Mercator sur le même serveur ? et comment ?
merci à vous

[dbarzin]

C'est possible, il faut configurer deux virtual hosts sous Apache. C'est décrit ici :
https://www.digitalocean.com/community/tutorials/how-to-set-up-apache-virtual-hosts-on-ubuntu-18-04-quickstart

[moiiom59]

Bonjour, Merci, Pouvez vous me dire si dans ce cas il faut configurer les deux sites en virtual host ou uniquement le second ? a2ensite site1.conf a2ensite site2.conf Merci

[dbarzin]

Cela peut fonctionner avec un seul virtual host et laisser l'autre en default host mais le mieux est de faire deux virtual hosts.

[myndbreaker]

thank you for this great tool.

I am part of our security Team and we are currently in the process of implementing deming and moving our isms to it.

[danje57]

Hello,

I would like to use ISO 27011:2022 in english.

However, when I installed Deming, the standard has been installed in french.

How can I use the English version without creating each item one by one?

Regards

[danje57]

Finally find the option under Configuration Menu and Import Option.

I'll try to remove all French wording.

Or try to clean the database and insert English version instead of French by default

[dbarzin]

If you have not followed the french installation procedure, it should be translated in english (lang="fr").

It is in the code here : https://github.com/dbarzin/deming/blob/main/database/seeders/MeasureSeeder.php

[danje57]

Yes!!! just showed this file, so I've understand that my ubuntu was not properly configured in full English!

I've cleaned the database and rebuilt ISO 27001:2022, and everything is in English now!

Perfect!

However thanks for your help!

I'll test your tool to see if it could replace my Excel file :)

And why not creating a PCI DSS standard for deming as I've made for Monarc :)

[dbarzin]

Look in the folder referentials of the project. We have NIST 800-53.

[djess159]

Bonjour Didier
J'ai un problème lorsque j'execute les commandes sur la migration de la bdd : " Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'column attributes to input' at line 1 (Connection: mysql, SQL: alter table controls rename column attributes to input)" l'erreur intervient lors de la normalization, sait tu pourquoi ?
Merci beaucoup par avance

[djess159]

Merci pour ton retour
Oui c'est bien ce fichier normalization qui pose problème
Oui j'ai suivis la procédure tout se passe bien et c'est lorsque j'execute cette commande lors de la procédure d'installation :

Exécuter les migrations

LANG=fr php artisan migrate --seed

Tout le reste passe bien, les autres migrations s'execute bien
J'essai de l'installé en Local dans un premier temps avec :

• PHP 8.1.13
• Mysql 5.7.39
• Apache 2.4.54

[dbarzin]

Quelle version de l'OS ?
Que renvoie la commande "composer update" ?

[djess159]

Mac OS big sur - 11.2.1

La commande a update ces 2 dépendances :
laravel/pint
laravel/sail

J'ai supprimé les tables et re executé la commande de migration et même problème sur ce fichier 2023_01_30_180336_normalization

Merci encore pour votre aide

[dbarzin]

Merci,

Tu peux essayer de remplacer

        $table->renameColumn("attributes", "input");
        $table->renameColumn("tags", "attributes");

par

        $table->renameColumn("`attributes`", "`input`");
        $table->renameColumn("`tags`", "`attributes`");

Si cela ne fonctionne pas, effectuer la commande SQL manuellement dans mysql et mettre les deux lignes en commentaire.

[djess159]

C'est résolue en changeant manuellement dans mysql comme vous m'avez conseillé,
Merci beaucoup pour votre aide

[charlesgoyard]

Bonjour Didier, je viens de regarder la présentation faite chez Be Cyber (super !), et tu parles d'une future gestion des dérogations. Je n'ai pas bien compris de quoi il s'agit, est-ce qu'on peut s'en servir pour y consigner par exemple les risques acceptés, c'est à dire ce qu'on a pas envie de corriger par-rapport au référentiel utilisé ? Ou bien il s'agit de toute autre chose ?
Merci

[dbarzin]

La gestion des dérogations à la politique de sécurité dans un SMSI est un processus d'identification, d'évaluation des risques, d'approbation, de mise en œuvre et de suivi des exceptions aux politiques de sécurité établies. Elle vise à permettre des déviations temporaires lorsque nécessaire, tout en minimisant les risques potentiels pour la sécurité de l'information. Ce processus comprend la documentation de chaque dérogation et une communication avec les parties prenantes concernées, assurant ainsi une approche transparente et contrôlée pour gérer les situations où la conformité stricte aux politiques de sécurité n'est pas possible.

[charlesgoyard]

Merci pour la réponse détaillée, c'est très clair. Ce sera très utile en effet 👍.

[danje57]

Dear community,

I've just installed Deming as I want to use it in my day2day job.

I've done a test a few month ago, and I really appreciate Deming.

However, within my new instance freshly installed with ISO 27002:2022, I can't see all controls into the control list window...

But normally control are presents, as per this screen:

When I use the Search tool, I can find controls:

Then I can have access to them:

I've reinstalled 3 times following the procedure, however this behavior is still present.

Can you tell me where I'm wrong?

Regards